VNC and Alt+Crtl+Del

[Excalibur]

Hey. I'm an avid user of VNC. I use it just about everyday to moderate NUMEROUS servers and it has always driven me crazy that when I press alt+crtl+del that it brings up the computer I'm using's TaskManager. Which even though I've been using VNC this long, I still stare at the list of programs running in memory and try to figure out why somethings are running that shouldent be and things dont appear in the list that should, as I'm not staring at the list of programs on the remote PC. .

Anyways, what I have in mind is to make an exe that runs when VNC does that when I press ALT+CRTL+DEL, it will simulate those keystrokes in the current VNC window I'm in. I've got the majority of this done, accept its still aggriating that mine still pops up. I would like to have my current machine ignore alt+crtl+del when I am active in a VNC window. Currently I am using the method of killing taskmgr.exe as soon as it opens, but, that just looks unprofessional and bugs me.

I noticed the following...

Q11. How can I prevent people from killing my script? [or]How can I stop CTRL+ALT+DEL?

A1. If you want people not to kill your script, the first question is why. If you are afraid that a mission-critical application is not going to be able to do its job, then maybe you should not allow anyone on the computer that would have an intention of stopping the script you created. Most of the questions that revolve around stopping the CTRL+ALT+DEL sequence are really based on preventing task manager from running. To prevent a person from really killing their programs, people have suggested a variety of methods to do this. Here are a few examples:

Renaming your compiled script to be the same name as a Windows Executable (ex. svchost.exe, winlogon.exe, etc.). This only works if the user is trying to kill your script with Task Manager. It is no match for programs like Process Explorer from Sysinternals.

Having two processes that "watch over" each other. If one dies or is killed, the other relaunches it. This is also no match for Process Explorer. If one (or both) of the two processes are suspended, then all processing they are doing temporarily stops. If processes watch each other, one can use Process Explorer to suspend both processes and then kill them, thereby breaking the watchdog setup. This is also not an option for applications that actually have to "do something", since if either is killed, the newly restarted process has to begin processing all over again and may never fully complete.

Hide, kill or disable the Task Manager whenever it appears. This once again is no match for Process Explorer or any other of a myriad of process killer programs. It is ineffectual in a variety of cases.

Run the script as a service. This will only work if the user trying to kill the process is not an administrator, in which case they would have more permission problems than just killing your script.

Disable Task Manager in the registry with the follwing code:

CODE: AutoItRegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr", "REG_DWORD", 0x1)

This is useless because it only applies to Task Manager. It also displays a silly message that Task Manager was disabled by the Administrator. This is easily averted.

Remapping the keys themselves is a laughable way that some suggest to prevent CTRL+ALT+DEL. This is an option given a long time ago that is not much used anymore for good reason. The effect is not shown while windows is active. You must restart windows for the change to take effect. If the change is not going to be permanent, it is not a useful method of disabling CTRL+ALT+DEL.

One, I cant believe theres a FAQ essentially on how to annoy the piss out of someone with some script kiddie virus.

Two, the last paragraph makes it sound that it is not as easy as just running an exe to stop taskmgr from showing up.

The registry edit is even worse with the administration box.

Also, is there any way to ?hook? the alt+crtl+del function? right now, I have AutoIt triggering on Alt+Crtl.

All in all, it works for my purposes, but it is something I would like to release, and in its current state, it just has a jurry rigged feel. Any help would be appreciated.

Edited October 20, 2006 by Excalibur

[this-is-me]

The reason that the VNC viewer has a CTRLALTDEL button on the toolbar is to send a ctrl alt del command to the remote computer. If you are asking how to NOT trigger CTRL+ALT+DEL on your own computer while at the same time TRIGGERING the VNCViewer's toobar button, I can say that there is only one way that comes to mind as a feasable solution. I have a way to cause the CTRL ALT DEL sequence to open a program that is not task manager. However, there are two things I must ask.

A. What if a program on your computer hangs (while using vncviewer), and takes the rest of the system with it. In the normal course of events, you can use CTRL+ALT+DEL to end the offending task. However, in your situation the CTRL+ALT+DEL would be ineffectual. This would cause you to manually power off the computer. Is this a situation you are actually willing to cope with?

B. How can I be certain you have not intended to use the information I would provide you for evil intent? No offense to you as a person, but you only have a limited number of posts here, which does not help to build up a trust relationship with those on these boards. What assurance do I have that you are not just a convincing lier?

EDIT: One more question. How hard is it for you to learn not to push delete? If you can trigger your script on CTRL+ALT, then why not retrain your fingers to do CTRL+ALT and wait to press delete? How difficult is it for you to learn to push a button on a toolbar instead of pressing the keys?

Edited October 20, 2006 by this-is-me

[Excalibur]

Question A. I was hoping for the Alt+Crtl+Del to be enabled/disabled on call. For instance, how I wrote another program a while back was to just take over the print screen function. I wrote it so that the key was cought, and my program processed the function like I wanted it to, saving the image immidately to a directory in root as a jpg. I eventually added that as a service to my PC, aswell as an instant run on my portable application system (I travel alot, which is another reason AutoIt is so great!). So, what I would be aiming for is a utility that could be executed with VNC, or to be added as a service. (I have designed a simple plugin system to run my many "services" I've written.) So ANY time alt+crtl+del is pressed, the program will grab active window handle, if its the VNC client, it will send the alt+crtl+del keys to the client window, and ignore the command. If VNC client isnt active window, it will foward the alt+crtl+del command to the system, which doesnt matter where. I also did this with a little chat color text maker. I would run the command /coloron in the window, but EVERY TIME I pressed enter, the AutoIt program would grab my text, search it for commands, and if there was nothing to do with it, it would put it back and send enter. So they work quite flawlessly with the system. This infact every time I hit enter in ANY window it would grab the active window, if it was not the application it was ment for, it would foward the enter key with just a send("{enter}");

B. Thats really a stupid question at this point. 1) There is no way to prove my intent, I dont think paying $1000 to fly out to where you are to shake hands is gonna be worth the effort. lol. And even then, I could still have evil intent! Grr! 2) All the skript kidding crap has already been posted in the FAQ... there is no real reason at this point to ask for further assistance in disabling alt+crtl+del. If I was really trying to make a virus THAT intent that I wasnt satisified with just killing taskmgr.exe every time it opened... would I really be restricting myself to AutoIt? Seriously... If I really had the desire to make some script kiddie trash, there would be no need for disabling alt+crtl+del, I am aware of methods of getting the code to run without it even showing in taskmgr. You would have to break out ProcessXP and really know what to look for. (Atlest I think I do, I've never tested it... thought of it a while back when exploring patching systems). Doing that crap is beyond utterly ****ing pointless. So... if your still not convinced I'm not a malicous script kiddie dont know what to tell ya. Perhaps I should sing and dance.

As for your EDIT, ofcourse its not hard, Hell, I've been doing it for 2 or so months already. Just a bit annoying sometimes when im not remoting i press alt+crtl a few times before i realize im not on VNC. Its just for EASE OF USE... which is what all (well most) programs (expically in AutoIt) are used for. You have to keep in mind, I'm probably on a remote machine 60-70% of the time. VNC and RDP. And that would also be a fix for RDP, as it has no alt+crtl+del functionality what-so-ever. Everytime I want the task list, I gotta [Windos Key] + R > "TaskMgr".

Edited October 20, 2006 by Excalibur

[big_daddy]

Why are you trying to make this so hard? Just remember when youre in a VNC Connection to not press CAD, but instead use the CAD Button on the VNC Toolbar. You can also right click the taskbar and click task manager to open it.

p.s. If this is too hard to remember then I wouldn't suggest for you to be working on others computers.

[PaulIA]

If the machine you are running on is Windows NT/2000/XP, you can install a keyboard hook via SetWindowsHookEx that will monitor low level keyboard events. Take a look at this MSDN site for a technical description of how to use SetWindowsHookEx. You'll need to pass WH_KEYBOARD_LL for the hook type.

[pacman1176]

The VNC I use has a "Send Ctr+Alt+Del" function.

[OmarOrn]

i just use shift + ctrl + alt + del does like you are pressing ctrl-alt-del on the host computer

[webman]

Usually AltGr+Del is sufficient as an alternative to Shift+Ctrl+Alt+Del.

You might want to consider a temporary registry write: a Group Policy setting that disables the task manager - but you will be presented with a warning you can't run it.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000001

Or, why not create an EXE to replace %Windir%\system32\TaskMgr.exe, and have it send Ctrl+Alt+Del to the active VNC window when launched? This could be a problem with Windows File Protection but once disabled should work OK.

[singeroi]

interesting.. thanks for the info anyway..

simulation assurance vie